dsh-plugin-toolkit 0.8.4 → 0.8.6

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## 0.8.6
+
+- `release --publish`: run `npm publish` locally instead of waiting for a
+  publish workflow. Plenty of small plugins have no release pipeline; before
+  this, `release` tagged, pushed and then waited for a registry that would never
+  receive the version.
+- The publish failure reports the last line of npm's stderr, so a 403 reads like
+  a 403.
+
+## 0.8.5
+
+- `release --market <dir>`: write the index entry into a checkout of the
+  repository that owns the index, and open the pull request there. Before this,
+  `release` only touched a `market/index.json` inside the plugin's own repo, so
+  anyone listed in a central market had to patch the entry by hand — which is
+  where the timestamp goes wrong.
+- `--index` still names the file inside that repository.
+
 ## 0.8.4
 
 - README: `## When the panel does not appear` — the five checks that explain a

package/README.md

@@ -320,6 +320,28 @@ merged
 
 Without `--pr` it prints the `git add` / `gh pr create` commands instead of running them; `--dry-run` prints the whole sequence before anything happens. A re-run after a failure is safe: the same version with the same publish time is a no-op.
 
+### When nothing publishes for you
+
+`release` assumes a tag starts a workflow that publishes. Repositories without
+one use `--publish`, which runs `npm publish` in the same step:
+
+```sh
+$ dsh-plugin release . --publish
+```
+
+### When the index lives in someone else's repository
+
+Most plugins are listed in a central market repository, not their own. Point
+`--market` at a checkout of that repository and the entry — and the pull
+request — land there:
+
+```sh
+$ dsh-plugin release . --market ../market-repo --pr --merge
+tagged plugin-v0.4.0, npm served my-plugin@0.4.0 after 92s
+updated /Users/me/market-repo/market/index.json on market/0.4.0
+merged
+```
+
 ## Exit codes
 
 | Code | Meaning |

package/lib/cli.mjs

@@ -37,6 +37,8 @@ export const HELP = `dsh-plugin — preflight and release DeepSeek Harness plugi
 Flags
   --dry-run                 show the steps without touching anything
   --index <path>            index file, default market/index.json
+  --market <dir>            with release: a checkout of the repository that holds the index
+  --publish                 with release: run npm publish here, for repos without a publish workflow
   --tag-prefix <prefix>     default plugin-v
   --budget <seconds>        how long to wait for npm, default 480
   --pr                      commit the index on a branch, push it, open the pull request
@@ -71,7 +73,9 @@ function flags(argv) {
     else if (token === '--timeout') parsed.timeout = Number(argv[++index]);
     else if (token === '--pr') parsed.pr = true;
     else if (token === '--merge') parsed.merge = true;
+    else if (token === '--publish') parsed.publish = true;
     else if (token === '--base') parsed.base = argv[++index];
+    else if (token === '--market') parsed.market = argv[++index];
     else if (token.startsWith('--') === true) throw new Error(`unknown flag ${token}`);
     else parsed.positional.push(token);
   }
@@ -210,6 +214,8 @@ export async function run(argv, io = console) {
     const result = await release({
       dir,
       indexFile: options.index,
+      marketDir: options.market,
+      publish: options.publish === true,
       tagPrefix: options.tagPrefix,
       budgetMs: options.budget === undefined ? undefined : options.budget * 1000,
       pr: options.pr === true,

package/lib/release.mjs

@@ -5,7 +5,7 @@
  * registry, then touch the index — the index entry carries the publish time the
  * registry reported, so writing it earlier would mean guessing.
  */
-import { run } from './exec.mjs';
+import { run as runCommand } from './exec.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -14,11 +14,15 @@ import { addVersion, buildEntry, readIndex, writeIndex } from './index-file.mjs'
 import { publishedAt, waitForVersion } from './registry.mjs';
 import { defaultGh, mergePr, openIndexPr, waitForChecks } from './pr.mjs';
 
+function publishPackage(dir) {
+  runCommand('npm', ['publish'], { cwd: dir, stdio: 'pipe' });
+}
+
 function git(dir, args) {
   // stderr is dropped on purpose: `rev-parse` on a tag that does not exist yet is
   // an expected miss, and git prints "fatal: ambiguous argument" for it, which
   // reads like a failure in the middle of a successful release.
-  return run('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+  return runCommand('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
 }
 
 export function tagName(version, prefix = 'plugin-v') {
@@ -51,7 +55,7 @@ export function dirtyPaths(dir, limit = 3, run) {
  * anything runs is what makes `--dry-run` useful: it shows the whole sequence
  * and the exact commands.
  */
-export function plan({ dir = process.cwd(), version, name, tagPrefix = 'plugin-v', indexFile = 'market/index.json' }) {
+export function plan({ dir = process.cwd(), version, name, tagPrefix = 'plugin-v', indexFile = 'market/index.json', marketDir }) {
   const report = doctor(dir);
   const resolvedName = name ?? report.manifest.name ?? 'this-plugin';
   const resolvedVersion = version ?? report.manifest.version ?? '0.0.0';
@@ -61,7 +65,13 @@ export function plan({ dir = process.cwd(), version, name, tagPrefix = 'plugin-v
     { title: `Create the tag ${tag}`, command: `git tag ${tag}`, runs: true },
     { title: 'Push the tag, which starts the release workflow', command: `git push origin ${tag}`, runs: true },
     { title: `Wait until the registry serves ${resolvedName}@${resolvedVersion}`, command: `GET /${resolvedName}`, runs: true },
-    { title: 'Write the version into the market index, with the publish time the registry reported', command: `patch ${indexFile}`, runs: true },
+    {
+      title: marketDir === undefined
+        ? 'Write the version into the market index, with the publish time the registry reported'
+        : `Write the version into the market index at ${marketDir}`,
+      command: `patch ${path.join(marketDir ?? '', indexFile)}`,
+      runs: true,
+    },
     { title: 'Open the index pull request', command: 'gh pr create', runs: false },
     { title: 'Re-read the live index and confirm the version is listed', command: 'GET market/index.json', runs: false },
   ];
@@ -74,6 +84,7 @@ export async function release(options) {
     registry,
     tagPrefix = 'plugin-v',
     indexFile = 'market/index.json',
+    marketDir,
     budgetMs,
     intervalMs,
     sleep,
@@ -115,6 +126,17 @@ export async function release(options) {
   gitRun(['tag', tag]);
   gitRun(['push', 'origin', tag]);
 
+  // Not every plugin publishes from CI. `--publish` runs the publish here, so
+  // the same command covers both kinds of repository.
+  if (options.publish === true) {
+    try {
+      (options.publishPackage ?? publishPackage)(dir);
+    } catch (error) {
+      const detail = String(error.stderr ?? error.message).trim().split('\n').slice(-1)[0];
+      return { ok: false, stage: 'publish', failures: [{ check: 'publish', message: `npm publish failed: ${detail}` }] };
+    }
+  }
+
   const waited = await waitForVersion(name, version, {
     // Wait for the publish *time* as well: `versions` can appear a moment before
     // `time`, and an index entry with a null timestamp fails the market checker.
@@ -155,7 +177,10 @@ export async function release(options) {
 
   const timestamp = publishedAt(waited.document, version);
   const entry = buildEntry({ version, publishTimestamp: timestamp, hostRange: report.notes.hostRange });
-  const indexPath = path.join(dir, indexFile);
+  // Most plugins are listed in someone else's index: `--market` points at a
+  // checkout of that repository, and the entry plus the pull request land there.
+  const indexRoot = typeof marketDir === 'string' && marketDir.length > 0 ? path.resolve(marketDir) : dir;
+  const indexPath = path.join(indexRoot, indexFile);
   let indexUpdate = null;
   if (fs.existsSync(indexPath) === true) {
     try {
@@ -163,10 +188,10 @@ export async function release(options) {
       const after = addVersion(before, name, entry);
       if (after !== before) {
         writeIndex(indexPath, after);
-        indexUpdate = { file: indexFile, version, entry };
+        indexUpdate = { file: indexPath, version, entry };
         if (typeof onChange === 'function') onChange(indexUpdate);
       } else {
-        indexUpdate = { file: indexFile, version, entry, unchanged: true };
+        indexUpdate = { file: indexPath, version, entry, unchanged: true };
       }
     } catch (error) {
       return { ok: false, stage: 'index', failures: [{ check: 'index', message: error.message }] };
@@ -188,16 +213,17 @@ export async function release(options) {
   // The index change is one line, but it still needs a branch, a pull request,
   // a green CI and a merge; doing that by hand is where "forgot to open the PR"
   // happens.
-  const ghRunner = options.gh ?? defaultGh(dir);
+  const ghRunner = options.gh ?? defaultGh(indexRoot);
+  const marketGit = options.marketGit ?? (indexRoot === dir ? options.git : ((args) => git(indexRoot, args)));
   const pull = await openIndexPr({
-    dir,
+    dir: indexRoot,
+    git: marketGit,
     indexFile,
     version,
     base: options.base ?? 'main',
     branch: options.branch,
     title: options.prTitle,
     body: options.prBody,
-    git: options.git,
     gh: ghRunner,
     onStep: options.onStep,
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-toolkit",
-  "version": "0.8.4",
+  "version": "0.8.6",
   "description": "Preflight, release and test DeepSeek Harness plugins: checks what the host needs, waits for npm to actually serve the version, and keeps the market index honest.",
   "type": "module",
   "bin": {